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(U) Suspicious Activity Reporting (SAR): Weapons Discovery 


(U//FOUO) Possession of large amounts of weapons, ammunition, explosives, accelerants, or explosive precursor chemicals 
could indicate pre-operational terrorist attack planning or criminal activity. For example, in preparation for conducting the July 
2011 attacks in Norway, Anders Behring Breivik stockpiled approximately 12,000 pounds of precursors, weapons, and armor 
and hid them underground in remote, wooded locations. 


(U//FOUO) Recent SAR incidents reported to the Nationwide SAR 
Initiative (NSI) shared space highlight the types of weapons discoveries 
that are suggestive of pre-operational activity and attack planning. 
Although neither incident was linked to terrorist activity, they are cited 
as examples for awareness and training purposes. 

» (U) Upon entering a residence to serve a search warrant, police 
discovered six small improvised explosive devices (lEDs), a small 
incendiary device, a hoax IED, and a glass jar filled with smokeless 
powder, nuts, bolts, and other fragmentation sealed with wax. The 
police arrested and charged the homeowner with multiple counts, 
including manufacturing a destructive device. 

» (U) During a traffic stop, police discovered 7 firearms (4 pistols, 1 
shotgun, and 2 rifles), approximately 5,000 rounds of ammunition, 21 
ammunition magazines, a 12-gauge ammunition belt with rounds, a 
pistol holster with magazine pouch, a punch knife, and other 
materials in the vehicle. The police arrested and charged the driver 
and passenger with weapons possession. 


(U) NSI Definition of Weapons Discovery: 
Discovery of unusual amounts of 
weapons or explosives that would arouse 
suspicion in a reasonable person. 


UNCLASSIFIED 



(U) Weapons cache discovered by 
local law enforcement. 

(U) Note: The Functional Standard, v. 1.5 
defines SAR as "official documentation of 
observed behavior reasonably indicative 
of pre-operational planning related to 
terrorism or other criminal activity. 


(U) Possible Indicators of Criminal Weapons Possession Related to Terrorism 

(U//FOUO) The following activities could indicate attempts to stockpile large quantities of weapons or explosive materials for use in an attack. 
Depending on the context time, location, personal behaviors, and other indicators persons who attempt to acquire explosive materials or 
precursors should be reported to appropriate authorities. 

(U//FOUO) Large quantities of weapons are typically cached in a location such as an individual's home, storage facility, or vehicle, but can be 
found attended by the individual (such as in luggage while traveling) or unattended (discarded or seemingly discarded) in a public area. 

» (U//FOUO) Illegal possession of firearms (rifles, shotguns, pistols, and military grade firearms) and ammunition; 

» (U//FOUO) Possession of explosives such as lEDs (including rockets, grenades, pipe bombs, and other homemade explosives) 

and other destructive devices; and 
» (U//FOUO) Dangerous objects artfully concealed at security screening checkpoints or in areas where weapons are not allowed. 

(U//FOUO) Constitutional activities should not be reported in a SAR or Information Sharing Environment (ISE) SAR absent articulable facts and circumstances 
that support the source agency's suspicion that the behavior observed is not innocent, but rather reasonably indicative of criminal activity associated with 
terrorism, including evidence of pre operational planning related to terrorism. Race, ethnicity, national origin, or religious affiliation should not be considered as 
factors that create suspicion (although these factors may be used as specific suspect descriptions). 



(U) This report is derived in part from information reported under the NSI. It is part of a series based on SARs intended to help identify and encourage reporting of 
activities that, in some cases, could constitute preparations for terrorist attacks. 
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(U) Report Suspicious Activity 


(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and emergency managers should follow established protocols; 
all other personnel should call 911 or contact local law enforcement. SARs will be forwarded to the appropriate fusion center and FBI Joint Terrorism Task 
Force for further action. For more information on the Nationwide SAR Initiative, visit http://nsi.ncirc.gov/resources.aspx. 
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